Knowledge Management
Highlighted

Missing Event/Field workflow from "Statistics" tab?

Esteemed Legend

I have a Workflow actions configuration like this:

Apply only to the following fields: "Work Order ID", Work_Order_ID
Apply only to the following event types: WIN_ET*
Show action in: Both
Action type: link
URI: http://wo?$Work Order ID$
Open link in: New window
Link method: get

After a restart, I expected that I would have a new workflow on the Statistics tab when I click on any Work Order ID field, but NO!

index=* eventtype=WIN_ET* | eval Work_Order_ID="W123456789" | eval "Work Order ID" = Work_Order_ID | table W*O

Instead, I have to click on the Events tab, then click the > button under i (turning it into v) and then scroll down to the fields area of an event, click on the Actions column's v control. Here is the ONLY place the Lookup Work Order W123456789 workflow menu item appears. It does not even appear under the workflows accessed by clicking on the Event Actions v button.

What's up with that? I absolutely must have a Work Order URL lookup available on the Statistics tab. How can I do this? Do I need to configure a drilldown action? I am trying to avoid using a form/dashboard; I need something that works directly from the Statistics tab.

Highlighted

Re: Missing Event/Field workflow from "Statistics" tab?

Esteemed Legend

Do note that there are other workflows on that tab, but mine is not there.

0 Karma
Highlighted

Re: Missing Event/Field workflow from "Statistics" tab?

Esteemed Legend

Also, permissions are app-level; maybe I will try Global...

0 Karma
Highlighted

Re: Missing Event/Field workflow from "Statistics" tab?

SplunkTrust
SplunkTrust

The statistics tab doesn't display any workflow actions.

0 Karma
Highlighted

Re: Missing Event/Field workflow from "Statistics" tab?

Builder

I was under same impression as Martin. I haven't seen workflows on stats tab. Would be cool if it was there. I think you are going to need to go form/drilldown route.

0 Karma
Highlighted

Re: Missing Event/Field workflow from "Statistics" tab?

Splunk Employee
Splunk Employee

As others have mentioned, the Event/Field workflows are not available in the statistics tab/table view. The data/rows shown here are not directly linked to Events in this view, i.e. you are seeing data from events but the information about the data to the event is not present there. Think of this like looking at store bought food presented on a snack tray, but then you can't check the nutrition facts looking at the food because the food is without the packaging.

I could see how being able to have workflows on fields in Statistics (if possible) would be useful. If this is a feature you'd like to request, note that we have an internal Enhancement Request: SPL-119276 .

To request this feature (and show support for it), please create a Support ticket with Splunk mentioning this Splunk Answer page and ask to be added to ER SPL-119276. Support will link your request to this ER and close the support case (which basically functions like an upvote for the ER).

Happy Splunking!

0 Karma